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ON THE SURJECTIVITY OF MOD t REPRESENTATIONS ASSOCIATED TO 

ELLIPTIC CURVES 

DAVID ZYWINA 


Abstract. Let E be an elliptic curve over the rationals that does not have complex multiplication. 
For each prime £, the action of the absolute Galois group on the ^-torsion points of E can be given 
in terms of a Galois representation pE.f. '■ Gal(Q/Q) —> GL 2 (F«). An important theorem of Serre 
says that pE,i is surjective for all sufficiently large i. In this paper, we describe an algorithm based 
on Serre’s proof that can quickly determine the finite set of primes i for which pE,i is not surjective. 
We will also give some improved bounds for Serre’s theorem. 


1. Introduction 

Let £ be a non-CM elliptic curve defined over Q. For each prime £, let E[£] be the Utorsion 
subgroup of E(Q ), where Q is a fixed algebraic closure of Q. The group E[£] is a free F^-vector 
space of dimension 2 and there is a natural action of the absolute Galois group GalQ := Gal(Q/Q) 
on E[£] which respects the group structure. After choosing a basis for E[£], this action can be 
expressed in terms of a Galois representation 

Pe,£'■ GalQ —>• GL 2 (F£). 

A renowned theorem of Serre shows that pe t is surjective for all sufficiently large primes £, 
cf. [Ser72]. 

Let c{E) be the smallest integer n > 1 for which pe e is surjective for all primes £ > n. Serre 
has asked whether the constant c(E) can be bounded independent of E [Ser72, §4.3], and moreover 
whether c(E) < 37 always holds [Ser81, p. 399]. We pose a slightly stronger conjecture; first define 
the set of pairs 

S 0 := { (17, —17 2 -101 3 /2), (17,-17-373 s /2 17 ), (37, —7-ll 3 ), (37,-7-137 s • 2083 s ) }. 

Denote by ;)e the j-invariant of E/Q. When (£,je) € Sq, the curve E has an isogeny of degree £ 
and hence Pei is not surjective, cf. [Zywl5] for a description of the image of pE,t- 

Conjecture 1.1. If E is a non-CM elliptic curve over Q and l > 13 is a prime satisfying (£, jp) ^ 

So, then pE,i{ GalQ) = GL2(F^). 

The main goal of this paper is to give a simple and practical algorithm to compute the finite set 
of primes £ for which pei is not surjective. We will focus on the case £ > 11 since using [Zywl5], 
we can easily compute the group PE,e(GalQ), up to conjugacy in GL 2 (F^), for all the primes £ < 11. 
We will also give improved upper bounds for c(E). 

Notation. For an elliptic curve E/Q , denote its j-invariant and conductor by j& and Ne, respec¬ 
tively. For each prime p for which E has good reduction, define the integer a p (E) = |E(F P )| — (p+1), 
where E(¥ p ) is the F p -points of a good model at p. For each good prime p ^ £, the representation 
Pe,£ is unramified at p and satisfies tr(/9£; i £(Frob p )) = a p (E) (mod £) and det(/9/5^(Fl'ob p )) = p 
(mod £), where Frob p € Galjj is an (arithmetic) Frobenius at p. For primes p for which E has 
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bad reduction, we set a p (E) = 0, 1 or —1, if E has additive, split multiplicative or non-split 
multiplicative reduction, respectively, at p. Let v p : Q p -» Z be the valuation for the prime p. 

1.1. An algorithm. Fix a non-CM elliptic curve E/ Q. We now explain how to compute a finite 
set S of primes such that pE,e is surjective for all primes £ ^ S. 

Let q± < ■ ■ ■ < qd be the primes p that satisfy one of the following conditions: 

• p = 2 and v p (jjE) is 3, 6 or 9, 

• p > 3 and v p (j E — 1728) is positive and odd. 

Take any odd prime p for which E has Kodaira symbol Io or Iq. Equivalently, E/ Q or its 
quadratic twist by p has good reduction at p; denote this curve by E p /Q. 

Let pi < P 2 < P 3 < Pa < ■ ■ ■ be the odd primes such that E has Kodaira symbol Io or Iq and 
such that the integer a* := \a Pi (E Pi )\ is non-zero. Note that the set of such primes p* has density 
1, cf. [Ser81, Theorem 20]. 

For integers i > 1 and 1 < j < d, define the following values in F 2 : 

{ 0 if qj is a square modulo pi, JO if —1 is a square modulo pi, 

and pi = < 

1 otherwise, I 1 otherwise. 

It is easy to compute cqj and /%; with respect to the isomorphism F 2 = {±1} they are simply 
Legendre symbols. For each integer m > 1, let A m £ M m ^(F 2 ) be the m x d matrix whose (z, j)-th 
entry is and let b m £ F™ be the column vector whose z-th entry is /%. 

Let r > 1 be the smallest integer for which the linear equation A r x = b r has no solution. By 
Dirichlet’s theorem for primes in arithmetic progressions, there is an integer zq > 1 such that 
a io,j = 0 f° r a H 1 < j < d and f3 l0 = 1. So r < zo and in particular r is well-defined. 

Let S be the set of primes l such that l < 13, (7, Je) £ So, or a* = 0 (mod l) for some 1 < z < r; 
it is finite since So Is finite and each a* is non-zero. We will prove the following in §3. 

Theorem 1.2. The representation pE,t is surjective for all primes i £ S. 

We will explain in §6 how to test the surjectivity of pe £ for the finitely many primes £ £ S. 

Example 1.3. We have used Theorem 1.2 to verify Conjecture 1.1 for all elliptic curves E/Q with 
conductor at most 360000 (Magma code is given in Appendix A). In fact, for all such curves E/Q 
our computations show that p r < 71. By the Hasse bound, we have a* < 2^/pi < 2\/71 < 17 for 
1 < z < r. Therefore, the set S — {2,3,5,7,11,13} is either empty or is {£} when {£,je) € Sq. 
In particular, we did not need to directly check the surjectivity of pE £ for any exceptional primes 
£ > 13. 

There are earlier results that produce an explicit finite set S that satisfies the conclusion of 
Theorem 1.2. For example, the bounds of Kraus and Cojocaru mentioned in §1.3 will give such sets 
(S'; however, the resulting sets S can be extremely large and testing surjectivity of pe t for the finite 
number of £ £ S can be time consuming. Stein verified Conjecture 1.1 for curves of conductor at 
most 30000 using the bound of Cojocaru, cf. [Ste] ; the resulting sets S would typically consist of 
thousands of primes (this should be contrasted with Example 1.3). 

Remark 1.4. 

(i) The set S does not change if we replace E by a quadratic twist and hence it depends only 
on j E . 
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(ii) In practice, the most time consuming part of computing S is to determine the odd primes 
p for which v p (jE — 1728) is positive and odd; note that the curve E has bad reduction at 
such primes p. However, observe that we do not need to determine all the primes of bad 
reduction. (Contrast this with § 1 . 2 , where we find an alternate set S when Je $. Z by only 
using the primes that divide the denominator of Je ) 

1.2. Non-integral j-invariants. Let E/Q be a non-CM elliptic curve. The following, which will 
be proved in §4, shows that if pE.e is not surjective, then the denominator of je must be of a special 
form. 

Theorem 1.5. Letpf 1 ■ ■ ■ p e s s be the factorization of the denominator ofjE, where thepi are distinct 
primes with e* > 0 . If pE,e is not surjective for a prime I > 13 with (IQe) ^ So, then each pi is 
congruent toil modulo £ and each a is divisible by £. 

Now suppose that the j-invariant of E is not an integer (the theorem is trivial otherwise). Let 
g be the greatest common divisor of the integers pf — 1 and e* with 1 < i < s. Let S be the set of 
primes £ such that £ < 13, (. £,je ) € So, or g = 0 (mod £). The set S is finite. The following is a 
direct consequence of Theorem 1.5. 

Proposition 1.6. If j e is not an integer, then the representation pe t is surjective for all primes 

£(/S. 

Example 1.7. We have verified Conjecture 1.1 for all non-CM elliptic curves E/Q in the Stein- 
Watkins database (it consist of 136,924,520 elliptic curves with conductor up to 10 8 ). Proposi¬ 
tion 1.8 sufficed for all E/Q with js ^ Z (i.e., there were no primes £ € S that needed to be 
checked individually). The integral j-invariants that needed to be considered were handled with 
the algorithm from § 1 . 1 . 

We now give some easy bounds for c(E). 

Proposition 1.8. Suppose that jE is not an integer. 

(i) We have c(E) < max{17, g}. 

(ii) We have c(E) < max{17, (p + l)/2} for every prime p with v p (jE ) < 0. 

(iii) We have c{E) < max{17, log d}, where d > 1 is the denominator of jE- 

Proof. Note that if ( £,jE) € So, then £ = 17. The first bound is immediate from Proposition 1.6 
since max S < max{17, g}. Suppose that p is a prime satisfying v p (jE ) < 0 and pex is not surjective 
for a prime £ > 17. By Theorem 1.5, we have p = ±1 (mod £). Since p + 1 and p — 1 are not 
primes, we must have £ < (p + l)/2. By Theorem 1.5, the denominator d is divisible by p £ and is 
thus at least (£ — 1 ) e . Hence, £ < £log(£ — 1) < logd. □ 

Remark 1.9. For any non-CM elliptic curve E/Q, Masser and Wiistholz [MW93] have shown that 
c(E) < c(max{l, h(jE)}) 1 , where c and 7 are absolute constants (which if computed are very large) 
and h(jE) is the logarithmic height of j e ■ Proposition 1.8(iii) gives a simple version in the case 
j E Z since logd < h(j E )- 

1.3. A bound. We now discuss some bounds for c(E) in terms of the conductor. Kraus [Kra95] 
proved that 

c{E) < 68 rad(iV£;)(l + loglograd(iV £;)) 1//2 

where t&(1(Ne) = Ildjv B P- Using a similar approach, Cojocaru [Coj05] showed that c(E) is at 
most |\/6 • Ne rip|Ar £ (1 +1 / P ) 1 ^ 2 +1. We shall strengthen these bounds with the following theorem 
which will be proved in §5. 
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Theorem 1.10. Let E/Q be a non-CM elliptic curve that has no primes of multiplicative reduction. 
Then 

c(£)<max{37, 

p\N E 

In particular, c(E) < max {37, NjJ 2 }. 

Suppose that we are in the excluded case where E/Q has multiplicative reduction at a prime 
p. Then the bound c(E) < max{37, (p + l)/2} from Proposition 1.8 already gives a sizeable 
improvement over the bounds of Kraus and Cojocaru. 

Acknowledgements. Thanks to Andrew Sutherland and Barinder Singh Banwait. Thanks also to 
Larry Rolen and William Stein for their corrections of an older version of this paper. Computations 
were performed with Magma [BCP97]. 


2. The character e t 

Fix a non-CM elliptic curve E/Q and a prime I > 13 with (£, j E ) So such that the represen¬ 
tation pej. is not surjective. 

Proposition 2.1 (Serre, Mazur, Bilu-Parent-Rebolledo). With assumptions as above, the image 
of PE,e ti es i n normalizer of a non-split Cartan subgroup of GL2(F^). 

Before explaining the proposition, let us recall some facts about non-split Cartan subgroups. A 
non-split Cartan subgroup of GL 2 (F^) is the image of a homomorphism F * 2 Autp^F^) = GL 2 (F^), 
where the first map comes from acting by multiplication and the isomorphism arises from some 
choice of F^-basis of ¥p. Let C be a non-split Cartan subgroup; it is cyclic of order ( 2 — 1 and 
is uniquely defined up to conjugacy in GL 2 (F^). Let N be the normalizer of C in Autp^F^) = 
GL 2 (F^); it is the subgroup generated by C and the automorphism a e-?> a^ of ¥p. In particular, 
[N : C] = 2. 

Fix a non-square e € F^. After replacing C by a conjugate, one can take C to be the group 
consisting of matrices of the form ( g ^ e ) with (a, b) € F^ — {(0, 0)}; the group N is then generated 
by C and the matrix (J _?i) • For all g € N — C, g 2 is scalar and tr(g) = 0. 

Proof of Proposition 2.1. Suppose that p E) t is not surjective; its image lies in a maximal subgroup 
H of GL 2 (F^). We have det(ps^(Gal(Q))) = F^ since the character deto p E ^ corresponds to the 
Galois action on the t'-th roots of unity. Therefore, det(iL) = F^. From [Ser72, §2], we find that, 
up to conjugation, H is one of the following: 

(a) a Borel subgroup of GL 2 (F£), 

(b) the normalizer of a split Cartan subgroup of GL 2 (F£), 

(c) the normalizer of a non-split Cartan subgroup of GL 2 (F£), 

(d) for l = ±3 (mod 8 ), a subgroup of GL 2 (F^) that contains the scalar matrices and whose 
image in PGL 2 (F^) is isomorphic to the symmetric group © 4 . 

That PE,e(Galo) is not contained in a Borel subgroup when l > 13 and (l,j E ) ^ So is a theorem of 
Mazur, cf. [Maz78]; the modular curves Ao(17) and Xo(37) each have two rational points which are 
not cusps or CM points and these points are explained by the pairs (£, j E ) € Sq. Bilu, Parent and 
Rebolledo have shown that pe/(Gs^q) cannot be conjugate to a subgroup as in (b), cf. [BPR13]; 
they make effective the bounds in earlier works of Bilu and Parent using improved isogeny bounds 
of Gaudron and Remond. Serre has shown that PE,<?(Gal(rj) cannot be conjugate to a subgroup as 
in (d), cf. [Ser81, §8.4]. Therefore, the only possibility for H is to be a group as in (c). □ 
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By Proposition 2.1 and our assumption on Pej, the image of pE.i is contained in the normalizer 
N of a non-split Cartan subgroup C of GL 2 (F£). Following Serre, we define the quadratic character 

ef. Gal Q -^4 N/C -4 {±1}. 

For each prime p , let I p be an inertia subgroup of GalQ at p. Recall that E£ is unramified at p if and 
only if si(Ip) = {1}. We now state several basic lemmas concerning the character E£. Let qi,...,qd 
be the primes from § 1 . 1 . 

Lemma 2.2. 

(i) The character eh is unramified at £ and at all primes p ^ {gi,..., qd}- 

(ii) If p £ {(/i,..., qd} — {£}, then PE,e(Ip) contains —I and an element of order 4. 

Proof. Take any prime p. 

• First suppose that p = £. Let 1} be the maximal pro-£ subgroup of fi. We have PEiflf) = 1 since 
N has cardinality relatively prime to l. The group PeAJ() is cyclic since every finite quotient of 
the tame inertia group I? / 1} is cyclic, see [Ser72, §1.3] for the the structure of I(_ / 1 [. Fix a generator 
g of PE,e(h)- B y the proof of [Ser81, p.397 Lemme 18’], the image PE,i(Ii) hi PGL 2 (F£) contains 
an element of order at least {£ — l)/4 > 2. The order of the image of g in PGL 2 (F^) is greater than 
2, so g 2 is not a scalar matrix. However, g 2 is a scalar matrix for all g £ N — C. So g belongs to 
C and thus pE,i(Ii) C. Therefore, Et is unramified at £. 

• Suppose that p £ and that E has good reduction at p. We have PE.e(Ip) = {7} U C since pe,i 
is unramified at such primes p. Therefore, E£ is unramified at p. 

• Suppose that p £ and that v p (Je) < 0. Using a Tate curve, we shall show in §4 that E£ is 
unramified at p (and moreover that e^(Frob p ) = p (mod £))\ the proof will use the definition of E£ 
but none of the successive lemmas in this section. 

• Finally suppose that p £ is a prime for which E bad reduction at p and v p {je) > 0. Choose 
a minimal Weierstrass model of E/Q and let A, C 4 and cq be the standard invariants attached to 
this model as given in [Sil09, III §1]. 

Let be the image of I p under pej- We can identify 4> p with Gal(L/Qp D ) where L is the smallest 
extension of Q“ n for which E base extended to L has good reduction. Moreover, one knows that 

is isomorphic to a subgroup of Aut(if) where E/¥ p is the reduction of E/L, cf. [Ser72, §5.6]. 
We have ‘hp C SL 2 (F^) since deto p^ g is ramified only at the prime £. In particular, if there is an 
element in with order 2 , then it is —I. 

Consider p > 5. The group Aut(E') is cyclic of order 2, 4 or 6 , so <3? p is cyclic of order 2, 3, 4 or 
6 . We have Je — 1728 = Cg/A, so v p (jE — 1728) = v p (A) (mod 2). From [Ser72, §5.6], we find that 
has order 2, 3 or 6 if and only if v p (j — 1728) is even. 

Consider p = 3. The group Aut (E) is now either cyclic of order 2, 4 or 6 , or is a non-abelian 
group of order 12 (it is a semi-direct product of a cyclic group of order 4 by a distinguished subgroup 
of order 3). Using that v p (jE — 1728) = v p (A) (mod 2) and Theoreme 1 of [Kra90], we find that 
has order 2, 3 or 6 if and only if v p (j — 1728) is even. 

Consider p = 2. Then the group Aut(-E’), and hence also is isomorphic to a subgroup of 
SL 2 (F 3 ). The group is either cyclic of order 2, 3, 4 or 6 , isomorphic to the order 8 group 
of quaternions {±1, ±z,±j, ±fc}, or is isomorphic to SL 2 (Fs). We have je = c \/A and hence 
V 2 (je) = 3 u 2 (c 4 ) — u 2 (A). Checking all the cases in the corollary to Theoreme 3 of [Kra90], we find 
4>p has order 2, 3, 6 or 24 if and only if u 2 (je) ^ {3, 6 , 9}. The group SL 2 (F 3 ) is not isomorphic to a 
subgroup of N since SL 2 (F 3 ) is non-abelian and has no index 2 normal subgroups. Since <I> J) C N, 
this proves that |<& p | / 24. 

Now suppose that p ^ {qi,... ,qd}- From the above computations and our choice of qj, we find 
that has order 2, 3 or 6 . If <l>p has order 2 or 6 , then —I £ <I>p. Since —I £ C and [N : C] = 2, 

5 



we deduce that 4+ is a subgroup of C. Therefore, ££ is unramified at p. This completes the proof 
of (i). 

Finally suppose that p € {q \,..., qd} (and p / £). Then is cyclic of order 4, or has order 12 
(p = 3), or has order 8 (p = 2). In all these cases, 4>p contains an element g of order 4. The element 
g 2 of order 2 in C must be —I. This completes the proof of (ii). □ 

Remark 2.3. If £ = 1 (mod 4), then we claim that £i is ramified at a prime p if and only if 
p € {q ±,..., qd} — {£}. One direction of the claim is immediate from Lemma 2.2(i). Now take 
any prime p € {gi,... ,q r } — {£}. Suppose that ££ is unramified at p and hence 4> p := pE,e{Ip ) 
is a subgroup of C. We have C Cn SL 2 (F^) since detop^ is ramified only at £. The group 
C n SL 2 (F^) has no elements of order 4 since it is cyclic of order £ + 1 and £+1 = 2 (mod 4). This 
contradicts Lemma 2.2(h), so + is indeed ramified at p. 

Lemma 2.4. There are unique integers ei,..., € {0,1} such that ^(Frobp) = (=p) • n,=i ( 77 ) ^ 

for all odd primes p\ q\ - • - qd- In particular, £g / 1 . 

Proof. There is a unique squarefree integer D such that ^(Frobp) = (^p) for all odd primes p \ D. 
Let q be any prime dividing D. The character eg is ramified at q, so q = qj for some j by Lemma 2.2. 
Therefore, D divides q\ ■ ■ ■ qd- 

It remains to show that D is positive. It suffices to show that £g(c) = —1, where c € Galjj 
corresponds to complex conjugation under a fixed embedding Q <=>• C. Set g := pe/(c). We 
have g 2 = I since c has order 2. The matrix g has determinant —1 since the character detop^ 
corresponds to the Galois action on the £-th roots of unity. The Cartan subgroup C is cyclic since 
it is non-split, so the only elements of C with order 1 or 2 are / and —I. Since det(±/) = 1 , we 
deduce that g ^ C and hence £e(c) = — 1 as claimed. □ 

Lemma 2.5. Let p be a prime for which E has good reduction. If a p (E) ^ 0 (mod £), then 
e £ (Frob p ) = 1. 

Proof. That a p (E) = 0 (mod £) for every good prime p satisfying e(Frobp) = — 1 is [Ser72, 
p.317(c5)]; for p / £, this follows by noting that tr(p) = 0 for all g e N — C. □ 

3. Proof of Theorem 1.2 

Replacing E/Q by a quadratic twist does not change the set S or the set of primes £ for which 
Pe,£ is not surjective. We may thus assume that E has no odd primes p with Kodaira type Iq. So 
for each pi, we have aj = \a Pi {E)\. 

Suppose that £ ^ 5 is a prime for which pe/ is not surjective. From our choice of £, Proposition 2.1 
implies that the image of pE,e is contained in the normalizer of a non-split Cartan subgroup of 
GL 2 (F^). Let ££\ GalQ —>• {±1} be the corresponding quadratic character. By Lemma 2.4, there 
are unique e ±,..., € {0,1} such that e^(Frob p ) = (fy) ■ n ,=i ( 77 )^ f° r primes p \ 2q\ - - - qd- 

Now consider p = Pi with 1 < i < r. We have |a Pi (-E)| = a* ^ 0 (mod £) since £ ^ S. Lemma 2.5 
implies that ££(Frob Pi ) = 1 for all 1 < i < r. Therefore, 



for all 1 < i < r. Using the isomorphism {±1} = F 2 , this is equivalent to having XTy=i a i,j e j = Pi 
for all 1 < i < r. This shows that the equation A r x = b r has a solution in F^. This is a contradiction 
since the equation A r x = b r has no solution by our choice of r. Therefore, the representation pe 1 
must be surjective for all £ ^ S. 
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4. Proof of Theorem 1.5 


Take any prime p that divides the denominator oi j E - Everything that follows is a local argument, 
so by base extending we shall view E as an elliptic curve over we have a Galois representation 
Pe,V- GalQ p —> GL/ 2 (F£). There exists an element q £ Q p with v p {q) = —v p (j E ) > 0 such that 

j E = (l + 240V n 3 q n /(l-q n )) 3 /(qT\ (1 - q n ) 24 ) = q~ l + 744 + 196884^ + • • • ; 

let £/Q_p be the Tate curve associated to q, cf. [Sil94, V§3]. It is an elliptic curve with 7 -invariant 
j E and the group £(Q P ) is isomorphic to Q p /(q) as a GalQ p -module. In particular, the 7-torsion 
subgroup £[£] is isomorphic as an ¥( [GalQ p ]-module to the subgroup of Q p /(q) generated by an 
7-th root of unity Qg and a chosen 7-th root q 1 ^ of q. Let a: GalQ p —>• F* and /3: GalQ p —>• F^ be 
the maps defined so that 

<7(0) = and <7(9 1/! ) = Cf'’V /( 

for all a £ GalQ p . So for an appropriate choice of basis for £[f], we have — ( c, 'p d(a)^ f or 

<7 £ Galqj . The curves E and £ are quadratic twists of each other over Q p since they are non-CM 
curves with the same 7 -invariant. So there is a character x : GalQ p —>• {±1} such that, after an 
appropriate choice of basis for E[£], we have 

for all a £ GalQ p . 

Now assume that p E t is not surjective for a prime i > 13 with (£. j E ) ^ Sq. By Proposition 2.1, 
the image of p E 1 is contained in the normalizer IV of a non-split Cartan subgroup C of GL 2 (F^). 
Let ££-. GalQ —>• {±1} be the corresponding quadratic character. 

Since C is non-split, the only matrices in C with eigenvalue 1 or —1 are ±7. So if p E /(cr) belongs 
to C, then a(a) = 1 and (5(a) = 0. If p E< e(cr) belongs to IV — C, then a{a) = —1 since every matrix 
in IV — C has trace 0. This proves that a takes values in {±1} and that a(a) = e^(cr) (mod 7) 
for all a £ GalQ p . If £ = p, then a(GalQ p ) = F^ which is impossible since £ > 13 and a takes 
values in {±1}. So 7 7 - p and hence a(Frob p ) = p (mod £). Therefore, is unramified at p and 
£<j(Frob p ) = a(Frobp) = p (mod £). In particular, we must have p = ±1 (mod £). 

It remains to prove that e := —v p {je) is divisible by £. The matrices I and —I are the only 
elements of N that have eigenvalue 1 or —1 with multiplicity 2. Since a(GalQ p (^)) = 1, we must 
have /3(GalQ p (^)) = 0 and hence q 1 ^ £ Q p (Cf)- Extend the valuation v p of Q p to Q p (0)- Since 
Qp(0)/Qp is an unramified extension (we saw above that p / 7), we deduce that v p (q ] ^ : ) belongs 
to Z and hence e = — v p (jE) = v p (q) = £v p (q 1 £ e ) € 7Z. 

5. Proof of Theorem 1.10 

Suppose that p E ,e is not surjective for a prime 7 > 13 with (£,j E ) ^ S'o- We can then define a 
quadratic character £ 1 : GalQ —» {±1} as in §2. Let E' /Q be the elliptic curve obtained by twisting 
E/Q by eg. 

Lemma 5.1. The elliptic curves E and E' have the same conductors. 

Proof. Take any prime p. Lemma 1 of [Kra95] says that E and E' have the same reduction type 
(i.e., good, additive or multiplicative) at p. This proves that ord p (N E ) = ord p (NE') for p > 5. To 
prove this equality for p = 2 and 3, we need to check that the wild part of the conductors of E and 
E' at p agree; for a description of the wild part of the conductor at p. see [Sil94, IV§ 10]. 
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For our prime p < 3, it suffices to show that the groups PE,e(Ip ) and pE',i{Ip ) are conjugate in 
GL 2 (F^). After choosing appropriate bases of E[£] and E'[£], we may assume that pE’,t = ■ PE,e- 

If Ep is unramified at p, then PE’,e{Ip ) = PE,l{Ip)- We always have ±pe\i(I p ) = ±pE,e(Ip)- So if e# 
is ramified at p, then Lemma 2.2(ii) implies that PE'j(Ip) = EpE'.i(Ip) = ±pE,i(Ip) = PE,e{Ip)- C 


By Lemma 5.1, the elliptic curves E and E' the same conductor; denote it by N. By the 
modularity theorem (proved by Wiles, Taylor, Breuil, Conrad and Diamond), there are newforms 
/ and g G S 2 (Tq{N)) corresponding to E and E' , respectively. Let a n (f) and a n (g) be the rz-th 
Fourier coefficient of / and g at the cusp zoo. The following lemma gives a Sturm bound for a 
prime q that satisfies a q (f) / a q (g)- Note that / and g are distinct since e / 1 (by Lemma 2.4) 
and since E and E' are non-CM. 


Lemma 5.2. Let f and g be distinct normalized newforms in S 2 (Tq(N)). Then there exists a 
prime q such that 


(5.1) 




- 1 


and a q (f) / a q (g). 


Proof. Consider the modular curve Xq(N) defined over C. Its complex points form a Riemann 
surface obtained by quotienting the complex upper-half plane by To (IV) and then compactifying 
by adding cusps. For each prime power q = p e such that p e || N, let W q be a matrix of the form 

( Nc qd ) with a,b,c,d G Z that has determinant q. The matrix W q normalizes To (IV) and thus 
induces an automorphism of Xq (IV). Let W(N) be the subgroup of Aut(Ao(lV)) generated by the 
{Wp*}p,\\N- The group W(N) is isomorphic to (Z/2Z) r where r is the number of distinct prime 
factors of N [AL70, Lemma 9]. The group W(N ) permutes the cusps of Xq (IV) and the stabilizer 
of the cusp zoo is trivial. 

For the newform /, consider the holomorphic differential form g = f(z)dz on Xq (IV). For each 
automorphism w G W(N), there is a A w (f) G {±1} such that g(wz) = \ w (f)g(z), cf. [AL70, 
Theorem 3]. Similarly, we have values A w (g) G {±1} for w G 1T(IV). 

Let H be the set of w G W(N) for which A w {f) = ^w(d)] it is a subgroup of W(N) of cardinality 
2 r or 2 r_1 . The holomorphic differential form u := (f(z) — g(z))dz is non-zero since / and g 
are distinct. Let K = div(w) be the corresponding (effective) divisor on Ao(IV); it has degree 
2g Xo (N) ~ 2 where gx 0 {N) is the genus of Xq (IV). Therefore, 


^2 p oidp(uj) < 2 g Xo{N) - 2 

where the sum is over the cusps of Xq(N). For a fixed automorphism w G El, we have a cusp 
P = w ■ zoo. From our choice of H, we find that uj(wz) = ±w(z) and thus ordp(cj) = ordjoo(u;). 
Therefore, 

2 r_1 ordj 00 (ca) < \H\ ord ioo (a;) < 2 g Xo ( N ) - 2 < y ]^[(1 + 1/p) - 2 r 

b P\N 

where the last inequality uses an explicit formula for g Xo ( X ) [Shi94, Prop. 1.40] and that Xq(N) 
has at least 2 r cusps. Let n be the smallest positive integer for which the Fourier coefficients a n (f) 
and a n (g) disagree. We have ordjoo(u;) = n — 1, and hence 

1 N tt 

n < _ L 

p|JV 
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If n is prime, then we are done. If n is composite with a n (f) / a n (g), then a q (f) / a q (g) for some 
prime q dividing n (since / and g are normalized eigenforms, we know that their Fourier coefficients 
are multiplicative and are defined recursively for prime powers indices). □ 


Remark 5.3. If / and g are distinct modular forms on To (IV) of weight 2, then the same proof, 
but only looking at the cusp ioo, shows that there is an integer n < f Up^i 1 + J) such that 
a n (f ) / a n (g). This is the bound used in [Coj05] and [Kra95]; though possibly working with a 
larger N. 


By Lemma 5.2, there is a prime q satisfying (5.1) such that a q (E) = a q (f ) / a q (g) = a q (E'). 
Since a p (E) = a p {E') = 0 for primes of additive reduction, we find that E has either good or 
multiplicative reduction at q. By assumption, E has no primes of multiplicative reduction, so E 
has good reduction at q. 

Since a q {E) ^ ctq(E') = ^(Frob q )a q (E), we deduce that ££(Frob g ) = —1 and a q {E) / 0. By 
Lemma 2.5, we find that a q (E ) = 0 (mod £). The Hasse bound then implies that 


£<\ a q (E)\ < 2y/q < 2 


1 


fn(H)^n(H) V2 

p\N ^ p|iV 1 


1 \ 1/2 
2 py 


Since N is divisible by some prime (there is no elliptic curve over Q with good reduction every¬ 
where), we have £ < ^pIV 1 / 2 ^ + -j ) 1,/2 = IV 1 / 2 . 


6 . Remaining primes 


Fix a non-CM elliptic curve E/ Q. In this section, we explain how to determine whether is 
surjective for a fixed prime £. Combined with Theorem 1.2 (or possibly Proposition 1.6), this gives 
a method to compute the (finite) set of primes £ for which pe i is not surjective. 

We will also discuss the surjectivity of the ^-adic representations of E in §6.4. 


6.1. Primes £ < 11. Let £ be the elliptic curve over Q defined by the Weierstrass equation 


y 2 + y = x 3 — x z — 7x + 10 and let O be the point at infinity. The Mordell-Weil group 


is an 


infinite cyclic group generated by the point (4,5). Let J: £ 
by 

J(x,y) = (/l/ 2 / 3 / 4 ) 3 /(/ 5 2 / 6 n ), 

where 

fi = x 2 + 2>x — 6 , 
f 3 = 6y + 11® - 19, 
h = lly + (2x 2 + 17x-34), 


Ak U {oo} be the morphism given 


f 2 = H(x 2 - 5 )y + (2x 4 + 23x 3 - 72x 2 - 28x + 127), 
U = 22(x - 2)y + (5x 3 + 17x 2 - 112® + 120), 

.k = (x ~ 4 )y - (5® - 9). 


For £ < 11, the following gives a criterion to determine whether pe t is surjective or not. 


Proposition 6.1. Let E /Q be a non-CM elliptic curve. 

(i) The representation pe .2 is not surjective if and only if je = 256(t + l) 3 /t or je = t 2 + 1728 
for some t 6 Q. 

(ii) The representation pe.'s is not surjective if and only if jE = 27 (t + l)(t + 9) 3 /t 3 or jE = t 3 
for some t 6 Q. 

(iii) The representation pe ,5 is not surjective if and only if 

. _ 5 3 (t + l)(2t + l) 3 (2t 2 - 3f + 3 ) 3 . _ 5 2 (t 2 + 10t + 5 ) 3 

JE ~ (t 2 + t-l) 5 ’ JE ~ ¥ 
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or jE = t 3 (t 2 + 5 1 + 40) 







IV, 


for some t £ Q. 

The representation pej is not surjective if and only if 

t(t + 1 ) 3 (t 2 -5 1 + 1 f{t 2 -5 1 + 8 ) 3 (f 4 - 5 1 3 + 8 1 2 -7 1 + 7 ) 3 


J£ = 


Je = 


JE = 


(f 3 - 4 1 2 + 3t + l ) 7 

64f 3 (f 2 + 7) 3 (t 2 -7t + 14) 3 (5t 2 - 147 - 7 ) 3 
(■ t 3 - 7t 2 + 71 + 7 ) 7 
(t 2 + 245i + 2401) 3 (f 2 + 13 1 + 49) 
f 7 


or 


(v) 


VI 


for some t £ Q. 

T7ie representation pe,i\ is not surjective if and only if jE € {— 11 2 , — 11 • 131 3 } or jE = J{P ) 
/or some P £ £(Q) — {0}. 

//' /e is an integer, then pe,u is not surjective if and only if jE £ {—ll 2 ,—11 • 131 3 }. 

If jE is not an integer and pe,ii is not surjective, then the denominator of jE is of the form 
p \ 1 • • • p e s 3 with pi distinct primes such that pi = ±1 (mod 11 ) and e$ = 0 (mod 11 ). 

Proof. Parts (i)-(v) are consequence of the theorems from [Zywl5]; one need only consider the 
maximal subgroup of GI^F^). Note that the normalizer of a split Cartan subgroup in GL^IFa) is 
not a maximal subgroup. The normalizer of a split Cartan subgroup in GL^Fs) lies in a maximal 
subgroup of GL^Fs) whose image in PGI^Fs) is isomorphic to 64 . 

The curve £ and the map J come from Halberstadt’s description of X+(ll) in [Hal98]. In 
particular, the group / 0 E,n(GalQ) is conjugate to a subgroup of the normalizer of a non-split Cartan 
subgroup of GL 2 (Fn) if and only if jE = J{P ) for some P £ £(Q) — {O}. In [ST12], it is shown 
that if J(P) is an integer with P £ £(Q) — {O}, then J(P) is the /-invariant of a CM elliptic curve; 
this proves the first part of (vi). For the second part of (vi), note that the proof of Theorem 1.5 
applies verbatim. □ 

Remark 6.2. In [Zywl5], we give explicit polynomials A,B,C £ Q[X] of degree 55 such that jE = 
J{P) for some point P £ £(Q) — {O} if and only if the polynomial A(X)j^+B(X)jE+C{X) £ Q[X] 
has a root. So it straightforward to determine whether jE = J{P) for some P £ £(Q) — {O}. 

6.2. The prime I = 13. 

Proposition 6.3. 

(i) The representation pe, 13 is not surjective if 

j E = 2 4 • 5 • 13 4 • 17 3 /3 13 , 
j E = —2 12 • 5 3 • 11 • 13 4 /3 13 , 

;j E = 2 18 • 3 3 • 13 4 • 127 3 • 139 s • 157 3 • 283 s • 929/(5 13 • 61 13 ), or 
jE = ( t 2 + 5 1 + 13)(t 4 + 7f 3 + 20t 2 + 19f + 1 ) 3 /t for some t £ Q. 

(ii) The representation pe, 13 is surjective if and only if all the following conditions hold: 

• there is a prime p\ 13 Ne such that a p (E) ^ 0 (mod 13) and such that a p (E ) 2 — 4 p is 
a non-zero square modulo 13, 

• there is a prime p\ 13 Ne such that a p (E) ^ 0 (mod 13) and such that a p (E ) 2 — 4 p is 
a non-square modulo 13, 

• there is prime p \ 13 Ne such that the image of a p (E) 2 /p in F 13 is not 0, 1, 2 and 4, 
and is not a root of x 2 — 3x + 1. 

Proof. Part (i) is explained in [Zywl5]; the first three exceptional j-invariants come from [BC14]. 
Part (ii) is a direct consequence of Proposition 19 of [Ser72] and the Chebotarev density theorem. 

□ 
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Consider a non-CM elliptic curve E/Q. Suppose that Je is not one of those given in Proposi¬ 
tion 6.3(i); if it was then pe ,13 would not be surjective. Conjecturally, the representation pe ,13 will 
be surjective and hence this should be checkable using the criterion of Proposition 6.3(h). 

If the surjectivity is unknown even after computing a p (E ) for many primes p \ 13Ne, then one 
can do a direct computation. The representation pe ,13 is surjective if and only if the image of 
PE,i3(GalQ) in GL2(Fi3)/{±/} is the full group GL2(Fi3)/{±/}. For a given Weierstrass equation 
y 2 = x 3 + ax + b for E/Q one can compute the division polynomial of E at the prime 13; it is the 
monic polynomial f(X ) € Q[X] whose roots are the x-coordinates of the elements of order 13 in 
E( Q). The Galois group of f(x ) is isomorphic to the image of /9E,i3(GalQ) in GL2(Fi3)/{±/} and 
be computed directly. (For example, this was how the author found the interesting )-invariants 
2 4 • 5 • 13 4 • 17 3 /3 13 and —2 12 • 5 3 • 11 • 13 4 /3 13 before [BC14] was available.) 

Alternatively, if pe, 13 was not surjective, then one could construct a new rational point on one 
of the explicit genus 3 curves in [BC14] or [Bar 14], 

6.3. A surjectivity criterion for primes £ > 13. Fix a prime £ > 13. 

Proposition 6.4. The representation pe t_ is surjective if and only if (£,Je) ^ «So o,nd there is a 
prime p\ Ne£ such that a p (E) 0 (mod £) and a p (E) 2 — Ap is a non-zero square modulo £. 

Proof. As noted in the introduction, the representation pe/ is not surjective when (£,Je) £ So. So 
assume that (£,Je) ^ So- First suppose that there is a prime p\ Ne£ such that a p (E) ^ 0 (mod £) 
and a p (E) 2 — Ap is a non-zero square modulo £. With g := Pe,i( Frob p ), we have tr(_<y) 0 and 

tr(g) 2 — 4det(g) a non-zero square. Let N be the normalizer of a non-split Cartan subgroup C of 
GL2(F^). For all A € N — C, we have tr(A) = 0. For all A £ C, the value tr(A) 2 — 4det(A) € F^ is 
either zero or a non-square. So g ^ N, and hence ^^(Galig) is not a subgroup of the normalizer 
of a non-split Cartan. Therefore, pE,e is surjective by Proposition 2.1. 

Now suppose that pe/ is surjective. There are matrices A G GL2(F^) so that tr(A) / 0 and 
tr(A) 2 — 4det(A) is a non-zero square. That primes p as in the statement of the proposition occur 
is then a consequence of the Chebotarev density theorem. □ 

Assuming that Conjecture 1.1 holds, the criterion of Proposition 6.4 will always apply for some 
p and prove that pe/ is surjective when {1,je) ^ So- Using an explicit version of the Chebotarev 
density theorem, one could even give a bound for p. 

However, if (£,Je) ^ So and the surjectivity is unknown even after computing a p (E) for many 
primes p \ Ne£, then one can do a direct computation. The representation pe/ is surjective if 
and only if the image of p_B,£(Gal(Q) in GL2(F^)/{±/} is the full group GL2(Ff)/{±/}. For a given 
Weierstrass equation y 2 = x 3 + ax + b for E/Q one can compute the division polynomial of E at 
the prime £; it is the monic polynomial f(X) € Q[A] whose roots are the x-coordinates of the 
elements of order £ in E(Q). The Galois group of /(x) is isomorphic to the image of pe^Galq)) in 
GL2(F^)/{±/} and be computed directly. 

6.4. ^-adic surjectivity. For each integer n > 1, let E[£ n ] be the group of ^"-torsion in E{Q). The 
Tate module Q(E) of E is the inverse limit of the groups E[£ n ] with respect to the transition maps 
E[£ n+1 ] —> E[£ n ], P i->- £P. The Tate module Ti(E) is a free Z^-module of rank 2 with a natural 
GalQ-action. Let pE,t°°'- Galjj —>• Autz e (Ti(E)) = GL2(Z^) be the representation describing this 
Galois action. Using the results of this paper, and the following lemma, it is straightforward to 
compute the (finite) set of primes £ for which pE,e°° is not surjective. 

Lemma 6.5. Let E/Q be a non-CM elliptic curve. 
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(i) The representation pe,2°° is not surjective if and only if pe ,2 is not surjective or jE is of 
the form 

-4f 3 (t + 8), —t 2 + 1728, 2t 2 + 1728 or - 2t 2 + 1728 

for some t 6 Q. 

(ii) The representation pe, 3 °° is not surjective if and only if pe ,3 is not surjective or 

. _ 3 7 (i 2 — l) 3 (t 6 + 3t 5 + 6i 4 + t 3 — 3t 2 + I2t + 16) 3 (2t 3 + 3t 2 — 3t — 5) 

JE ~ (: t 3 -3 1- l) 9 

for some t G Q. 

(iii) If £ > 5, then pe,i°° is not surjective if and only if pe,i is not surjective. 

Proof. For the 2-adic and 3-adic cases, see [DD12] and [Elk06], respectively. When £ > 5, the 
lemma follows from Lemma 3.4 of [Ser98, IV §3.4], □ 

Appendix A. Some code 

Given a non-CM elliptic curve E/Q, the following Magma function outputs a finite set of primes 
S such that the representation pe t is surjective for all primes £ ^ S. It uses the algorithm of §1.1 
if jE is an integer and uses §1.2 otherwise. (Note that we could then use §6 to quickly determine 
the minimal such set S) 

ExceptionalSet:=fimction(E) 

j:=jInvariant(E); den:=Denominator(j); 

S:={2,3,5,7,13}; 

if j in {-11~2,-11*131~3} then S:=S join {11}; end if; 
if j in {-297756989/2, -882216989/131072} then S:=S join {17}; end if; 
if j in {-9317, -162677523113838677} then S:=S join {37}; end if; 
if den ne 1 then 

ispow,b,e:=IsPower(den); 
if ispow then 

P:={p: p in PrimeDivisors(e) I p ge 11}; 
if P ne {} then 

g:=GCD({&*P} join {p~2-l : p in PrimeDivisors(b)}); 

S:= S join {ell : ell in PrimeDivisors(g) I ell ge 11}; 
end if; 
end if; 

else 

D:=Discriminant(E); 

Q:=PrimeDivisors( GCD(Numerator(j-1728),Numerator(D)*Denominator(D))); 

Q:=[q: q in Q I q ne 2 and Is0dd(Valuation(j-1728,q))]; 
if Valuation(j,2) in {3,6,9} then Q: = [2] cat Q; end if; 
p:=2; 

alpha: = [] ; beta: = [] ; 
repeat 

a: =0; 

while a eq 0 do 

p:=NextPrime(p); K:=KodairaSymbol(E,p); 
if K eq KodairaSymbolC'IO") then 
a:=TraceOfFrobenius(E,p); 
elif K eq KodairaSymbolC'IO*") then 

a:=TraceOfFrobenius(QuadraticTwist(E,p),p); 
end if; 
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end while; 

S:=S join {ell : ell in PrimeDivisors(a) I ell gt 13}; 
alpha:= alpha cat [[(1-KroneckerSymbol(q,p)) div 2 : q in Q] ] ; 
beta:= beta cat [ [(1-KroneckerSymbol(-1,p)) div 2] ]; 

A:=Matrix(GF(2),alpha); b:=Matrix(GF(2),beta); 
until IsConsistent(Transpose(A),Transpose(b)) eq false; 
end if; 
return S; 
end function; 

The following code verifies Conjecture 1.1 for all elliptic curves E/Q in Cremona’s database 
[Cre]; currently this includes all curves of conductor at most 360000. 

D:=CremonaDatabase(); LargestConductor(D); 

for N in [1..LargestConductor(D)] do 
for E in EllipticCurves(D,N) do 
if not HasComplexMultiplication(E) then 

S:={p: p in ExceptionalSet(E) I p gt 13}; 
if jInvariant(E) in {-297756989/2, -882216989/131072} then 
assert S eq {17}; 

elif jInvariant(E) in {-9317, -162677523113838677} then 
assert S eq {37}; 
else 

assert S eq {}; 
end if; 

end if; 
end for; 
end for; 
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